● Covered by 3 sources · 3 reportsMedium impact3 negative
Residential Proxy Activity Detected on White House Network
Key points
- 236 proxy exits detected on White House network (AS2650).
- Activity occurred from October 5 to November 3, across 28 services.
- Pattern suggests a personal device infected with a proxy SDK.
- Poorly secured proxy SDKs can allow internal network access.
- Six IP addresses on AS2650 were used by 28 residential proxy services.
- Most activity occurred between 5 p.m. and midnight, Eastern Time.
- Traffic came from Windows 11 machines running the InfaticaSDK.
- Infatica is a web-data intelligence and proxy service based in Singapore.
Proxy Activity on White House Network
A newly launched Residential Proxy Observatory detected residential proxy exit activity on AS2650, the network registered to the Executive Office of the President, which hosts the White House network. This activity was observed 236 separate times between October 5 and November 3.
The proxy exits originated from 6 distinct IP addresses within the White House network, occurring on 26 out of 30 days. A total of 28 different residential proxy services were able to route traffic through this network. This observation was independently verified by other proxy detection services like Spur and Synthient.
Nature of the Activity
The observed proxy activity is publicly accessible, meaning anyone can obtain it by using a public residential proxy service. The detection was not a result of targeted efforts but occurred through general global rotating access requests via these services.
The timing of the activity, predominantly between 5 p.m. and midnight Eastern time, suggests a human user rather than a public guest Wi-Fi network. This pattern indicates a device regularly connected to the White House network late into the evening is likely infected with a proxy SDK.
Security Implications
The presence of a proxy SDK on a device within the White House network is concerning due to potential security vulnerabilities. Past research has demonstrated that poorly secured proxy SDKs can facilitate internal network access and lateral movement within a network.
For example, the Kimwolf botnet utilized residential proxy networks to infect millions of devices. If an SDK on the White House network possesses similar flaws, it could potentially allow individuals purchasing proxy access to reach internal systems, posing a significant security risk.
Updates
- Six IP addresses on AS2650 were used by 28 residential proxy services.
- Most activity occurred between 5 p.m. and midnight, Eastern Time.
- Traffic came from Windows 11 machines running the InfaticaSDK.
- Infatica is a web-data intelligence and proxy service based in Singapore.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Security firms Layer3 Intel and Synthient discovered residential proxy activity on the White House network, indicating that software on the network could allow outsiders to rent access to its IP addresses. This activity, potentially linked to a proxy SDK in an app like Rave, creates a vulnerability where malicious actors could route traffic through White House IPs, bypassing security measures and concealing their origins.
Security researchers found that multiple computers on the White House network were acting as residential proxy exit nodes. This indicates that devices within the network may be compromised with proxy SDKs, allowing external parties to route internet traffic through them.
Residential proxy exit activity was observed on the White House network (AS2650) 236 times from October 5 to November 3, originating from 6 addresses and 28 different proxy services. This indicates a device on the network is likely infected with a proxy SDK, posing a potential security risk for internal network access.